If the minimum power is raised too much, it can make it impossible for weaker
clients to connect, and there are some scenarios where the false detects will
not go down no matter how much the sensitivity is adjusted.
Fixes connectivity issues in some rare cases
Signed-off-by: NFelix Fietkau <nbd@nbd.name>

Update wiphy available antenna mask, and fix chainmask setting on 3x3 hardware
Signed-off-by: NFelix Fietkau <nbd@nbd.name>

Starting from commit 'a6bfb6d1 ("mt76: usb: use max packet length
for m76u_copy")' reg_val does not share memory with usb data buffer.
On non-coherent devices this approach can corrupt data pointer since data
and reg_val share the same cache-line, resulting in the following crash:

[  371.544901] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 8042fbb0
[  371.558521] CPU: 0 PID: 11 Comm: kworker/u2:2 Not tainted 4.14.160 #0
[  371.565204] Workqueue: mt76u mt76u_deinit [mt76_usb]
[  371.570331] task: 83823ac0 task.stack: 8386c000
[  371.575004] $ 0   : 00000000 80590000 00000000 00000000
[  371.580407] $ 4   : 82edaad0 00000002 83823ac0 fffffff8
[  371.585810] $ 8   : fffffffd 0000fc00 8052da00 00000000
[  371.591212] $12   : 000b2285 ae53a1a9 00108845 89da44c4
[  371.596615] $16   : 82edaad0 82ed9d20 00001798 832edf00
[  371.602019] $20   : 00000000 8386dda8 80530000 fffffffe
[  371.607421] $24   : 8051d040 76274d1b
[  371.612824] $28   : 8386c000 8386dd88 82edaad4 830d4d50
[  371.618228] Hi    : 000000f7
[  371.621203] Lo    : 33333371
[  371.624196] epc   : 8042fbb0 __mutex_lock.isra.2+0x134/0x378
[  371.630043] ra    : 830d4d50 mt76u_deinit+0x418/0xa6c [mt76_usb]
[  371.636237] Status: 1000fc03KERNEL EXL IE
[  371.640557] Cause : 0080000c (ExcCode 03)
[  371.644696] BadVA : 00000000
[  371.647671] PrId  : 00019374 (MIPS 24Kc)
[  371.726123]  usbcore nls_base usb_common
[  371.730180] Process kworker/u2:2 (pid: 11, threadinfo=8386c000, task=83823ac0, tls=00000000)
[  371.738884] Stack : 833d009c 83210b4c 82ed8bc0 8386ddac 000001ff 8008ac50 8386ddac 83b74b00
[  371.747519]         82edaad4 00000000 83b74b48 83210c38 82edaad0 82ed9d20 00001798 832edf00
[  371.756157]         00000000 00000000 80530000 fffffffe 80530000 830d4d50 00000040 8389d850
[  371.764794]         8052d9d8 8389d850 8386de30 82ed9d20 8386de5f 831c27bc 833d48ec 8052d9d8
[  371.773431]         83823ac0 83823af0 82edab00 82ed9d20 8386de5f 831c5c30 00000000 8052d9a8
[  371.782069]         ...
[  371.784598] Call Trace:
[  371.787130] [<8042fbb0>] __mutex_lock.isra.2+0x134/0x378
[  371.792622] [<830d4d50>] mt76u_deinit+0x418/0xa6c [mt76_usb]
[  371.808546]
[  371.810920] ---[ end trace c62f0601f6730eb0 ]---
[  371.818101] Kernel panic - not syncing: Fatal exception
[  371.824420] Rebooting in 3 seconds..

Fix the issue relying only on data buffer to send/receive usb control messages

Fixes: a6bfb6d1 ("mt76: usb: use max packet length for m76u_copy")
Signed-off-by: NLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: NFelix Fietkau <nbd@nbd.name>

Remove usb workqueue if mt76u_set_endpoints fails.

Fixes: 284efb47 ("mt76: mt76u: rely on a dedicated stats workqueue")
Signed-off-by: NLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: NFelix Fietkau <nbd@nbd.name>

Loop over all possible hw rx queues in mt76u_rx_tasklet since new
devices will report mcu events through mcu hw queue
Signed-off-by: NLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: NFelix Fietkau <nbd@nbd.name>

ath.git patches for v5.7. Major changes:

ath10k

* support for getting btcoex settings from Device Tree

* support QCA9377 SDIO device

ath11k

* add HE rate accounting

* add thermal sensor and cooling devices

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: b43-dev@lists.infradead.org
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: b43-dev@lists.infradead.org
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In a recent change to the SPI subsystem [1], a new `delay` struct was added
to replace the `delay_usecs`. This change replaces the current
`delay_usecs` with `delay` for this driver.

The `spi_transfer_delay_exec()` function [in the SPI framework] makes sure
that both `delay_usecs` & `delay` are used (in this order to preserve
backwards compatibility).

[1] commit bebcfd27 ("spi: introduce `delay` field for
`spi_transfer` + spi_transfer_delay_exec()")
Signed-off-by: NSergiu Cuciurean <sergiu.cuciurean@analog.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

hard_header_len provides limitations for things like AF_PACKET, such
that we don't allow transmitting packets smaller than this.

needed_headroom provides a suggested minimum headroom for SKBs, so that
we can trivally add our headers to the front.

The latter is the correct field to use in this case, while the former
mostly just prevents sending small AF_PACKET frames.

In any case, mwifiex already does its own bounce buffering [1] if we
don't have enough headroom, so hints (not hard limits) are all that are
needed.

This is the essentially the same bug (and fix) that brcmfmac had, fixed
in commit cb39288f ("brcmfmac: use ndev->needed_headroom to reserve
additional header space").

[1] mwifiex_hard_start_xmit():
	if (skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN) {
	[...]
		/* Insufficient skb headroom - allocate a new skb */

Fixes: 5e6e3a92 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: NBrian Norris <briannorris@chromium.org>
Acked-by: NGanapathi Bhat <ganapathi.gbhat@nxp.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Remove unneeded variable ret used to store return value.
Signed-off-by: NXu Wang <vulab@iscas.ac.cn>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The simple_strtol() function is deprecated since it does not
check for the range overflow. Use kstrtoint() instead.
Signed-off-by: Nchenqiwu <chenqiwu@xiaomi.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Remove unused fab_version member from struct rtw_hal.
Some of the checks being made were nonsense.
Signed-off-by: NKevin Lo <kevlo@kevlo.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Firmware supports only STA as primary interface in repeater mode.
Since the only meaningful usage of AP + STA interface combination
is repeater, reject such combination with AP as primary interface.
Signed-off-by: NDmitry Lebed <dlebed@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Quantenna Pearl device exposes multiple (up to 3) radio interfaces under
single PCIe function. So far all the wiphy devices were attached to the
same pcie device. As a result, all different wireless network devices
were reported under the same sysfs directory for pcie device, e.g.:

$ ls  /sys/class/net/wlan0/device/net/
  wlan0 wlan1

It turns out that such behavior may confuse various users of wireless
subsystem. For instance, it turned out to be the case for:
- Linux init systems, e.g. for renaming based on parent device
- OpenWRT configuration scripts

Suggested solution is to add an intermediate virtual platform device
for each radio interface.
Signed-off-by: NSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make sure that edmg field of cfg80211_chan_def structure is properly
initialized by zeros. Otherwise cfg80211_chandef_valid may return
false if edmg fields contain some garbage.
Signed-off-by: NSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Enable WPA3 OWE support in AP mode. Driver currently supports cards that
offload OWE processing to userspace. This patch adds all the required
tools for such offloading. Firmware requests OWE processing sending new
UPDATE_OWE event to driver, which uses cfg80211_update_owe_info_event to
notify userspace software. After OWE processing is completed, userspace
sends calculated IEs to firmware using update_owe_info cfg80211 callback.
Signed-off-by: NSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Enable WPA3 SAE support in AP mode. Driver currently supports cards
that offload SAE authentication to userspace. So allow userspace
software to subscribe and to send AUTH frames. Besides, enable
AP mode support in external_auth cfg80211 callback.
Signed-off-by: NSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: Jiri Slaby <jirislaby@gmail.com>
Cc: Nick Kossifidis <mickflemm@gmail.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: ath11k@lists.infradead.org
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Hardwares tested : QCA9887
Firmwares tested : 10.4-3.9.0.1-00036
Signed-off-by: NYibo Zhao <yiboz@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The definitions for the "qcom,smem-states" and "qcom,smem-state-names"
properties need to list their "$ref" under an "allOf" keyword.

In addition, fix two problems in the example at the end:
  - Use #include for header files that define needed symbolic values
  - Terminate the line that includes the "ipa-shared" register space
    name with a comma rather than a semicolon

Finally, update some white space in the example for better alignment.
Signed-off-by: NAlex Elder <elder@linaro.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

the following packetdrill script

  socket(..., SOCK_STREAM, IPPROTO_MPTCP) = 3
  fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
  fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
  connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
  > S 0:0(0) <mss 1460,sackOK,TS val 100 ecr 0,nop,wscale 8,mpcapable v1 flags[flag_h] nokey>
  < S. 0:0(0) ack 1 win 65535 <mss 1460,sackOK,TS val 700 ecr 100,nop,wscale 8,mpcapable v1 flags[flag_h] key[skey=2]>
  > . 1:1(0) ack 1 win 256 <nop, nop, TS val 100 ecr 700,mpcapable v1 flags[flag_h] key[ckey,skey]>
  getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
  fcntl(3, F_SETFL, O_RDWR) = 0
  write(3, ..., 1000) = 1000

doesn't transmit 1KB data packet after a successful three-way-handshake,
using mp_capable with data as required by protocol v1, and write() hangs
forever:

 PID: 973    TASK: ffff97dd399cae80  CPU: 1   COMMAND: "packetdrill"
  #0 [ffffa9b94062fb78] __schedule at ffffffff9c90a000
  #1 [ffffa9b94062fc08] schedule at ffffffff9c90a4a0
  #2 [ffffa9b94062fc18] schedule_timeout at ffffffff9c90e00d
  #3 [ffffa9b94062fc90] wait_woken at ffffffff9c120184
  #4 [ffffa9b94062fcb0] sk_stream_wait_connect at ffffffff9c75b064
  #5 [ffffa9b94062fd20] mptcp_sendmsg at ffffffff9c8e801c
  #6 [ffffa9b94062fdc0] sock_sendmsg at ffffffff9c747324
  #7 [ffffa9b94062fdd8] sock_write_iter at ffffffff9c7473c7
  #8 [ffffa9b94062fe48] new_sync_write at ffffffff9c302976
  #9 [ffffa9b94062fed0] vfs_write at ffffffff9c305685
 #10 [ffffa9b94062ff00] ksys_write at ffffffff9c305985
 #11 [ffffa9b94062ff38] do_syscall_64 at ffffffff9c004475
 #12 [ffffa9b94062ff50] entry_SYSCALL_64_after_hwframe at ffffffff9ca0008c
     RIP: 00007f959407eaf7  RSP: 00007ffe9e95a910  RFLAGS: 00000293
     RAX: ffffffffffffffda  RBX: 0000000000000008  RCX: 00007f959407eaf7
     RDX: 00000000000003e8  RSI: 0000000001785fe0  RDI: 0000000000000008
     RBP: 0000000001785fe0   R8: 0000000000000000   R9: 0000000000000003
     R10: 0000000000000007  R11: 0000000000000293  R12: 00000000000003e8
     R13: 00007ffe9e95ae30  R14: 0000000000000000  R15: 0000000000000000
     ORIG_RAX: 0000000000000001  CS: 0033  SS: 002b

Fix it ensuring that socket state is TCP_ESTABLISHED on reception of the
third ack.

Fixes: 1954b860 ("mptcp: Check connection state before attempting send")
Suggested-by: NPaolo Abeni <pabeni@redhat.com>
Signed-off-by: NDavide Caratti <dcaratti@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There is a spelling mistake in a dev_err message. Fix it.
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/ethernet/ibm/emac/core.c: In function __emac_mdio_write:
drivers/net/ethernet/ibm/emac/core.c:875:9: warning:
	variable err set but not used [-Wunused-but-set-variable]
Reported-by: NHulk Robot <hulkci@huawei.com>
Signed-off-by: NChen Zhou <chenzhou10@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Sparse reports a warning at netlink_seq_start()

warning: context imbalance in netlink_seq_start() - wrong count at exit
The root cause is the missing annotation at netlink_seq_start()
Add the missing  __acquires(RCU) annotation
Signed-off-by: NJules Irenge <jbi.octave@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Sparse reports warning at tcp_child_process()
warning: context imbalance in tcp_child_process() - unexpected unlock
The root cause is the missing annotation at tcp_child_process()

Add the missing __releases(&((child)->sk_lock.slock)) annotation
Signed-off-by: NJules Irenge <jbi.octave@gmail.com>
Reviewed-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Sparse reports warnings at raw_seq_start() and raw_seq_stop()

warning: context imbalance in raw_seq_start() - wrong count at exit
warning: context imbalance in raw_seq_stop() - unexpected unlock

The root cause is the missing annotations at raw_seq_start()
	and raw_seq_stop()
Add the missing __acquires(&h->lock) annotation
Add the missing __releases(&h->lock) annotation
Signed-off-by: NJules Irenge <jbi.octave@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In their .attach callback, mq[prio] only add the qdiscs of the currently
active TX queues to the device's qdisc hash list.
If a user later increases the number of active TX queues, their qdiscs
are not visible via eg. 'tc qdisc show'.

Add a hook to netif_set_real_num_tx_queues() that walks all active
TX queues and adds those which are missing to the hash list.

CC: Eric Dumazet <edumazet@google.com>
CC: Jamal Hadi Salim <jhs@mojatatu.com>
CC: Cong Wang <xiyou.wangcong@gmail.com>
CC: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: NJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

No need to play with gotos to jump over single statement.
Signed-off-by: NPavel Machek <pavel@ucw.cz>
Acked-by: NOliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since commit 319a1d19, stmmac only support basic HW stats type for
action. Set this field in the L3/L4 Filtering test so that it correctly
setups the filter instead of returning EOPNOTSUPP.

Fixes: 319a1d19 ("flow_offload: check for basic action hw stats type")
Signed-off-by: NJose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The NCM specification defines two formats of transfer blocks: with 16-bit
fields (NTB-16) and with 32-bit fields (NTB-32). Currently only NTB-16 is
implemented.

This patch adds the support of NTB-32. The motivation behind this is that
some devices such as E5785 or E5885 from the current generation of Huawei
LTE routers do not support NTB-16. The previous generations of Huawei
devices are also use NTB-32 by default.

Also this patch enables NTB-32 by default for Huawei devices.

During the 2019 ValdikSS made five attempts to contact Huawei to add the
NTB-16 support to their router firmware, but they were unsuccessful.
Signed-off-by: NAlexander Bersenev <bay@hackerdom.ru>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Reverted commit "2baecda3 bareudp: remove unnecessary udp_encap_enable() in
bareudp_socket_create()"

An explicit call to udp_encap_enable is needed as the setup_udp_tunnel_sock
does not call udp_encap_enable if the if the socket is of type v6.

Bareudp device uses v6 socket to receive v4 & v6 traffic

CC: Taehee Yoo <ap420073@gmail.com>
Fixes: 2baecda3 ("bareudp: remove unnecessary udp_encap_enable() in bareudp_socket_create()")
Signed-off-by: NMartin Varghese <martin.varghese@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In this function, ftgmac100_probe() can be triggered only
if the platform_device and platform_driver matches, so the
judgement at the beginning is redundant.
Signed-off-by: Ntangbin <tangbin@cmss.chinamobile.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When TPC is disabled IEEE80211_CONF_CHANGE_POWER event can be handled to
reconfigure HW's maximum txpower.

This fixes 0dBm txpower setting when user attaches to an interface for
the first time with the following scenario:

ieee80211_do_open()
    ath9k_add_interface()
        ath9k_set_txpower() /* Set TX power with not yet initialized
                               sc->hw->conf.power_level */

    ieee80211_hw_config() /* Iniatilize sc->hw->conf.power_level and
                             raise IEEE80211_CONF_CHANGE_POWER */

    ath9k_config() /* IEEE80211_CONF_CHANGE_POWER is ignored */

This issue can be reproduced with the following:

  $ modprobe -r ath9k
  $ modprobe ath9k
  $ wpa_supplicant -i wlan0 -c /tmp/wpa.conf &
  $ iw dev /* Here TX power is either 0 or 3 depending on RF chain */
  $ killall wpa_supplicant
  $ iw dev /* TX power goes back to calibrated value and subsequent
              calls will be fine */

Fixes: 283dd119 ("ath9k: add per-vif TX power capability")
Cc: stable@vger.kernel.org
Signed-off-by: NRemi Pommarel <repk@triplefau.lt>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The CONFIG_ATH5K_AHB could be enabled on ATH25 system without enabling
ATH5K driver itself.  This does not make sense because CONFIG_ATH5K_AHB
controls object build within drivers/net/wireless/ath/ath5k/ so enabling
it without CONFIG_ATH5K brings nothing.

Add proper dependency to CONFIG_ATH5K_AHB.
Signed-off-by: NKrzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>